CVE-2026-119083

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-119083

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119083.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-119083

Aliases

GHSA-rg2m-55pr-vp3q

Published

2026-11-05T16:34:57Z

Modified

2026-11-05T21:32:21Z

Severity

8.4 (High) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator

Summary

GluonTS arbitrary file write during archive extraction

Details

Path traversal in the archive extraction utility in GluonTS before 0.17.0 might allow an actor who supplies a crafted tar archive to write arbitrary files outside the intended extraction directory with the privileges of the extracting process via symbolic or hard links contained in the archive.

To remediate this issue, users should upgrade to version 0.17.0 or later.

Database specific

{
    "cna_assigner": "AMZN",
    "cwe_ids": [
        "CWE-22"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/119xxx/CVE-2026-119083.json"
}

References

Affected packages

Git / github.com/awslabs/gluonts

Affected ranges

Type

GIT

Repo

https://github.com/awslabs/gluonts

Events

Introduced

Fixed

99eb407d7dd8bd5726738a8fb409560d86d19de0

Database specific

Show details

{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.17.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "original_tag": "v0.17.0",
            "range": [
                {
                    "fixed": "99eb407d7dd8bd5726738a8fb409560d86d19de0"
                }
            ],
            "source": "REFERENCES_TAG"
        }
    ]
}

Affected versions

Other

ROOT

v0.*

v0.1.0

v0.1.1

v0.16.0rc1

v0.17.0rc1

v0.2.0

v0.2.1

v0.2.2

v0.2.3

v0.3.0

v0.3.1

v0.3.2

v0.3.3

v0.4.0

v0.4.1

v0.4.2

v0.5.0

v0.7.0

v0.9.0

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-119083.json"